---
title: "Get multiple users."
method: GET
path: "/users.json"
tags: ["Users"]
---

# Get multiple users.

`GET /users.json`

## Request

- Base URL: `https://passbolt.local`
- URL: `https://passbolt.local/users.json`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/passbolt/apis/passbolt-api/docs/users.json/get.ts> (a function with typed inputs; its response is checked against the schema)

## Query parameters

- `contain[last_logged_in]` 1 | 0
- `contain[groups_users]` 1 | 0
- `contain[gpgkey]` 1 | 0
- `contain[profile]` 1 | 0
- `contain[role]` 1 | 0
- `contain[missing_metadata_key_ids]` 1 | 0
- `filter[search]` string
- `filter[has-groups]` string[]
- `filter[has-access]` string[]
- `filter[is-admin]` boolean
- `filter[is-active]` boolean

## Response `200`

Operation is successful

- object
  - `header` HeaderWithPagination, required
    - `id` string, uuid, required
    - `status` 'success' | 'error', required
    - `servertime` integer, required
    - `action` string, uuid, required
    - `message` string, required
    - `url` string, uri, required
    - `code` integer, required
    - `pagination` object, required
      - `count` integer, required
      - `page` integer, required
      - `limit` integer, required
  - `body` UserIndexAndView[], required
    - `is_mfa_enabled` boolean
    - `id` string, uuid, required
    - `role_id` string, uuid, required
    - `username` string, required
    - `active` boolean, required
    - `deleted` boolean, required
    - `created` string, date-time, required
    - `modified` string, date-time, required
    - `disabled` string, date-time, required
    - `profile` object
      - `id` string, uuid, required
      - `user_id` string, uuid, required
      - `first_name` string, required
      - `last_name` string, required
      - `created` string, date-time, required
      - `modified` string, date-time, required
      - `avatar` object, required
        - `id` string, uuid
        - `profile_id` string, uuid
        - `created` string, date-time
        - `modified` string, date-time
        - `url` object, required
          - `medium` string, url, required
          - `small` string, url, required
    - `groups_users` GroupsUsersIndexAndView
      - `id` string, uuid, required
      - `group_id` string, uuid, required
      - `user_id` string, uuid, required
      - `is_admin` boolean, required
      - `created` string, date-time, required
      - `user` UserIndexAndView (recursive)
    - `gpgkey` Gpgkey
      - `id` string, uuid, required
      - `user_id` string, uuid, required
      - `armored_key` string, required
      - `bits` integer, required
      - `uid` string, required
      - `key_id` string, required
      - `fingerprint` string, required
      - `type` 'RSA' | 'ECC', required
      - `expires` string, date-time, required
      - `deleted` boolean, required
      - `created` string, date-time, required
      - `modified` string, date-time, required
    - `role` Role
      - `id` string, uuid, required
      - `name` 'admin' | 'guest' | 'user', required
      - `description` string, required
      - `created` string, date-time, required
      - `modified` string, date-time, required
    - `missing_metadata_key_ids` string[]
    - `last_logged_in` string, date-time

## Other responses

- `400`: Bad request
- `401`: Authentication required.
- `403`: Access restricted

## Changes

- **2025-06-25** `829cf48ab700`: 3 info
  - added the new optional `query` request parameter `contain[missing_metadata_key_ids]`
  - added the non-success response with the status `403`
  - added the optional property `body/items/missing_metadata_key_ids` to the response with the `200` status

[Operation history](https://skmtc.dev/passbolt/apis/passbolt-api/changes/users.json/get.md)

---

[API](https://skmtc.dev/passbolt/apis/passbolt-api.md) - [All operations](https://skmtc.dev/passbolt/apis/passbolt-api/llms.txt) - [OpenAPI document](https://skmtc.dev/passbolt/apis/passbolt-api/revisions/8d72215e2274?raw)